CVE-2026-91810: Out-of-bounds Read

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...

CVE-2026-91815: Out-of-bounds Write

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution...

CVE-2026-91807: Out-of-bounds Read

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash...

PT-2026-97669

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

PT-2026-97519

Name of the Vulnerable Software and Affected Versions GIMP versions prior to 3.2.6-3.1 Description An out-of-bounds heap read flaw exists in the TIM image loader. When processing a specially crafted 4bpp TIM image that triggers promotion to an RGBA layer, the file-tim plug-in allocates a row buff...

CVE-2026-96545: Out-of-bounds Read

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

CVE-2026-96546: Out-of-bounds Read

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...

CVE-2026-91808: Out-of-bounds Read

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an applicati...

CVE-2026-95820

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

CVE-2026-95820 anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

CVE-2026-95820

The software anirbandutta9 College-Notes-Gallery (up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6) is vulnerable to an unrestricted upload flaw. The issue resides in an unknown functionality within the file /dashboard/userprofile.php?section=admin1 , where manipulating the image argument al...

CVE-2026-95820 anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

GHSA-VV3M-F8X4-7377 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

EUVD-2026-84549

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

CVE-2026-85740 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

CVE-2026-85740 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

CVE-2026-92706

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like...

EUVD-2026-84518

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like...

CVE-2026-92706

Dark Reader , a browser extension that darkens web page colors, is vulnerable in its image inversion pipeline prior to version 4.9.126. A website can cause the extension to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTT...